How CORS works

Cross-origin resource sharing (CORS) defines a way for client web applications that are loaded in one domain to interact with resources in a different domain.

Cross-Origin Resource Sharing (CORS)

With CORS support, you can build rich client-side web applications with Amazon Simple Storage Service (Amazon S3) and selectively allow cross-origin access to your Amazon S3 resources.

Configure CORS

Configure your bucket to allow cross-origin requests.

CORS configuration

Create a CORS configuration with the required elements.

Turn on CORS

Turn on CORS for your bucket using your preferred method.

Configuring cross-origin resource sharing (CORS)

Use the Amazon S3 console, Amazon S3 REST API, or AWS SDK to turn on CORS.

Troubleshoot unexpected behavior

Use the following curated resources to troubleshoot unexpected behavior with CORS in Amazon S3.

Configure and confirm CORS in Amazon S3

How to configure CORs in Amazon S3, confirm the CORS rules using cURL, and allow cross-origin access to resources in your S3 bucket.

Resolve the "No 'Access-Control-Allow-Origin' header" error from CloudFront

How to resolve the "No 'Access-Control-Allow-Origin' header is present on the requested resource" error from Amazon CloudFront.

Resolve the "No 'Access-Control-Allow-Origin' header

Watch this video to understand the CORS error "No 'Access-Control-Allow-Origin'" header is present on the requested resource" and how to resolve it.

Troubleshoot CORS

How to troubleshoot unexpected behavior while accessing buckets set with the CORS configuration.

Related questions

See the following questions and answers related to common CORS issues in Amazon S3.

Request from static webside on s3 to API Gateway to Lambda, blocked by CORS

Answer to a common customer question about getting a CORS error when sending a request from a static website through a workflow.

Amazon S3 - Amazon CloudFront CORS configuration

Answer to a common customer question about Amazon CloudFront CORS configuration on the Stack Overflow website.

Access-Control-Allow-Origin

Answer to a common customer question about response headers and that your CORS configuration must be JSON syntax.